Update changelog

* New upstream release. - Remove upstreamed patches: add-debian-platform.diff, ipa-kdb-support-dal-version-5-and-6.diff, purge-firefox-extension.diff, fix-ipa-otpd-install.diff, fix-ipa-otpd-service.diff, purge-firefox-extension.diff - Remove obsolete patches: fix-memcached.diff, fix-oddjobs.diff - Refresh patches: fix-dnssec-services.diff, fix-ipa-conf.diff, fix-replicainstall.diff
2026-11-02 20:30:26 -06:00 · 2017-03-14 17:10:28 +02:00
1 parent 2dd6c8d70e
commit b0c33cd530
@@ -1,3 +1,17 @@
+freeipa (4.5.0-1) UNRELEASED; urgency=medium
+
+  * New upstream release.
+    - Remove upstreamed patches: add-debian-platform.diff,
+      ipa-kdb-support-dal-version-5-and-6.diff,
+      purge-firefox-extension.diff, fix-ipa-otpd-install.diff,
+      fix-ipa-otpd-service.diff, purge-firefox-extension.diff
+    - Remove obsolete patches: fix-memcached.diff,
+      fix-oddjobs.diff
+    - Refresh patches: fix-dnssec-services.diff,
+      fix-ipa-conf.diff, fix-replicainstall.diff
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Mar 2017 16:55:45 +0200
+
 freeipa (4.4.3-4) UNRELEASED; urgency=medium

  * fix-is-running.diff: Add a third argument to is_running() in
@@ -1,460 +0,0 @@
-commit b076743f2cdd3a3cb9e8d0e8be7be8c90160fc21
-Author: Timo Aaltonen <tjaalton@ubuntu.com>
-Date:   Fri Mar 1 12:21:00 2013 +0200
-
-    add debian platform support
-
--- /dev/null
-+++ b/ipaplatform/debian/__init__.py
-@@ -0,0 +1,22 @@
-+# Authors:
-+#   Timo Aaltonen <tjaalton@ubuntu.com>
-+#
-+# Copyright (C) 2014 Timo Aaltonen
-+# see file 'COPYING' for use and warranty information
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation, either version 3 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+
-+"""
-+This module contains Debian specific platform files.
-+"""
--- /dev/null
-+++ b/ipaplatform/debian/paths.py
-@@ -0,0 +1,112 @@
-+# Authors:
-+#   Timo Aaltonen <tjaalton@ubuntu.com>
-+#
-+# Copyright (C) 2014 Timo Aaltonen
-+# see file 'COPYING' for use and warranty information
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation, either version 3 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+
-+"""
-+This Debian base platform module exports default filesystem paths as common
-+in Debian-based systems.
-+"""
-+
-+# Fallback to default path definitions
-+from ipaplatform.base.paths import BasePathNamespace
-+import sysconfig
-+
-+MULTIARCH = sysconfig.get_config_var('MULTIARCH')
-+
-+class DebianPathNamespace(BasePathNamespace):
-+    BIN_HOSTNAMECTL = "/usr/bin/hostnamectl"
-+    AUTOFS_LDAP_AUTH_CONF = "/etc/autofs_ldap_auth.conf"
-+    ETC_HTTPD_DIR = "/etc/apache2"
-+    HTTPD_ALIAS_DIR = "/etc/apache2/nssdb"
-+    ALIAS_CACERT_ASC = "/etc/apache2/nssdb/cacert.asc"
-+    ALIAS_PWDFILE_TXT = "/etc/apache2/nssdb/pwdfile.txt"
-+    HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
-+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
-+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
-+    HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
-+    HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
-+    IPA_KEYTAB = "/etc/apache2/ipa.keytab"
-+    HTTPD_PASSWORD_CONF = "/etc/apache2/password.conf"
-+    NAMED_CONF = "/etc/bind/named.conf"
-+    NAMED_VAR_DIR = "/var/cache/bind"
-+    NAMED_KEYTAB = "/etc/bind/named.keytab"
-+    NAMED_RFC1912_ZONES = "/etc/bind/named.conf.default-zones"
-+    NAMED_ROOT_KEY = "/etc/bind/bind.keys"
-+    NAMED_BINDKEYS_FILE = "/etc/bind/bind.keys"
-+    NAMED_MANAGED_KEYS_DIR = "/var/cache/bind/dynamic"
-+    OPENLDAP_LDAP_CONF = "/etc/ldap/ldap.conf"
-+    ETC_DEBIAN_VERSION = "/etc/debian_version"
-+    IPA_P11_KIT = "/usr/local/share/ca-certificates/ipa-ca.crt"
-+    ETC_SYSCONFIG_DIR = "/etc/default"
-+    SYSCONFIG_AUTOFS = "/etc/default/autofs"
-+    SYSCONFIG_DIRSRV = "/etc/default/dirsrv"
-+    SYSCONFIG_DIRSRV_INSTANCE = "/etc/default/dirsrv-%s"
-+    SYSCONFIG_DIRSRV_SYSTEMD = "/etc/default/dirsrv.systemd"
-+    SYSCONFIG_IPA_DNSKEYSYNCD = "/etc/default/ipa-dnskeysyncd"
-+    SYSCONFIG_IPA_ODS_EXPORTER = "/etc/default/ipa-ods-exporter"
-+    SYSCONFIG_KRB5KDC_DIR = "/etc/default/krb5-kdc"
-+    SYSCONFIG_NAMED = "/etc/default/bind9"
-+    SYSCONFIG_NFS = "/etc/default/nfs-common"
-+    SYSCONFIG_NTPD = "/etc/default/ntp"
-+    SYSCONFIG_ODS = "/etc/default/opendnssec"
-+    SYSCONFIG_PKI = "/etc/dogtag/"
-+    SYSCONFIG_PKI_TOMCAT = "/etc/default/pki-tomcat"
-+    SYSCONFIG_PKI_TOMCAT_PKI_TOMCAT_DIR = "/etc/dogtag/tomcat/pki-tomcat"
-+    SYSTEMD_SYSTEM_HTTPD_D_DIR = "/etc/systemd/system/apache2.service.d/"
-+    SYSTEMD_SYSTEM_HTTPD_IPA_CONF = "/etc/systemd/system/apache2.service.d/ipa.conf"
-+    DNSSEC_TRUSTED_KEY = "/etc/bind/trusted-key.key"
-+    KRA_AGENT_PEM = "/etc/apache2/nssdb/kra-agent.pem"
-+    SBIN_SERVICE = "/usr/sbin/service"
-+    CERTMONGER_COMMAND_TEMPLATE = "/usr/lib/ipa/certmonger/%s"
-+    UPDATE_CA_TRUST = "/usr/sbin/update-ca-certificates"
-+    BIND_LDAP_SO = "/usr/share/doc/bind9-dyndb-ldap/copyright"
-+    BIND_LDAP_DNS_IPA_WORKDIR = "/var/cache/bind/dyndb-ldap/ipa/"
-+    BIND_LDAP_DNS_ZONE_WORKDIR = "/var/cache/bind/dyndb-ldap/ipa/master/"
-+    LIBSOFTHSM2_SO = "/usr/lib/softhsm/libsofthsm2.so"
-+    PAM_KRB5_SO = "/usr/lib/%s/security/pam_krb5.so" % MULTIARCH
-+    LIB_SYSTEMD_SYSTEMD_DIR = "/lib/systemd/system/"
-+    DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "/usr/lib/certmonger/dogtag-ipa-ca-renew-agent-submit"
-+    DOGTAG_IPA_RENEW_AGENT_SUBMIT = "/usr/lib/certmonger/dogtag-ipa-renew-agent-submit"
-+    IPA_SERVER_GUARD = "/usr/lib/certmonger/ipa-server-guard"
-+    GENERATE_RNDC_KEY = "/bin/true"
-+    IPA_DNSKEYSYNCD_REPLICA = "/usr/lib/ipa/ipa-dnskeysync-replica"
-+    IPA_DNSKEYSYNCD = "/usr/lib/ipa/ipa-dnskeysyncd"
-+    IPA_ODS_EXPORTER = "/usr/lib/ipa/ipa-ods-exporter"
-+    HTTPD = "/usr/sbin/apache2ctl"
-+    REMOVE_DS_PL = "/usr/sbin/remove-ds"
-+    SETUP_DS_PL = "/usr/sbin/setup-ds"
-+    VAR_KERBEROS_KRB5KDC_DIR = "/var/lib/krb5kdc/"
-+    VAR_KRB5KDC_K5_REALM = "/var/lib/krb5kdc/.k5."
-+    CACERT_PEM = "/var/lib/krb5kdc/cacert.pem"
-+    KRB5KDC_KADM5_ACL = "/etc/krb5kdc/kadm5.acl"
-+    KRB5KDC_KADM5_KEYTAB = "/etc/krb5kdc/kadm5.keytab"
-+    KRB5KDC_KDC_CONF = "/etc/krb5kdc/kdc.conf"
-+    KDC_PEM = "/var/lib/krb5kdc/kdc.pem"
-+    VAR_LOG_HTTPD_DIR = "/var/log/apache2"
-+    VAR_LOG_HTTPD_ERROR = "/var/log/apache2/error.log"
-+    NAMED_RUN = "/var/cache/bind/named.run"
-+    VAR_OPENDNSSEC_DIR = "/var/lib/opendnssec"
-+    OPENDNSSEC_KASP_DB = "/var/lib/opendnssec/db/kasp.db"
-+    IPA_ODS_EXPORTER_CCACHE = "/var/lib/opendnssec/tmp/ipa-ods-exporter.ccache"
-+    KRB5CC_HTTPD = "/var/run/apache2/ipa/krbcache/krb5ccache"
-+    IPA_CUSTODIA_SOCKET = "/run/apache2/ipa-custodia.sock"
-+    IPA_CUSTODIA_AUDIT_LOG = '/var/log/ipa-custodia.audit.log'
-+    IPA_GETKEYTAB = '/usr/sbin/ipa-getkeytab'
-+
-+paths = DebianPathNamespace()
--- /dev/null
-+++ b/ipaplatform/debian/services.py
-@@ -0,0 +1,198 @@
-+# Authors:
-+#   Timo Aaltonen <tjaalton@ubuntu.com>
-+#
-+# Copyright (C) 2014 Timo Aaltonen
-+# see file 'COPYING' for use and warranty information
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation, either version 3 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+
-+"""
-+Contains Debian-specific service class implementations.
-+"""
-+
-+import time
-+
-+from ipaplatform.tasks import tasks
-+from ipaplatform.base import services as base_services
-+from ipaplatform.redhat import services as redhat_services
-+from ipapython import ipautil
-+from ipapython.ipa_log_manager import root_logger
-+from ipalib import api
-+from ipaplatform.paths import paths
-+
-+# Mappings from service names as FreeIPA code references to these services
-+# to their actual systemd service names
-+debian_system_units = redhat_services.redhat_system_units
-+
-+debian_system_units['httpd'] = 'apache2.service'
-+debian_system_units['kadmin'] = 'krb5-admin-server.service'
-+debian_system_units['krb5kdc'] = 'krb5-kdc.service'
-+debian_system_units['named-regular'] = 'bind9.service'
-+debian_system_units['named-pkcs11'] = 'bind9-pkcs11.service'
-+debian_system_units['named'] = debian_system_units['named-pkcs11']
-+debian_system_units['pki-tomcatd'] = 'pki-tomcatd.service'
-+debian_system_units['pki_tomcatd'] = debian_system_units['pki-tomcatd']
-+debian_system_units['ods-enforcerd'] = 'opendnssec-enforcer.service'
-+debian_system_units['ods_enforcerd'] = debian_system_units['ods-enforcerd']
-+debian_system_units['ods-signerd'] = 'opendnssec-signer.service'
-+debian_system_units['ods_signerd'] = debian_system_units['ods-signerd']
-+debian_system_units['rpcgssd'] = 'rpc-gssd.service'
-+debian_system_units['rpcidmapd'] = 'nfs-idmapd.service'
-+debian_system_units['smb'] = 'smbd.service'
-+
-+# Service classes that implement Debian-specific behaviour
-+
-+class DebianService(redhat_services.RedHatService):
-+    system_units = debian_system_units
-+
-+
-+class DebianSysvService(base_services.PlatformService):
-+    def __wait_for_open_ports(self, instance_name=""):
-+        """
-+        If this is a service we need to wait for do so.
-+        """
-+        ports = None
-+        if instance_name in base_services.wellknownports:
-+            ports = base_services.wellknownports[instance_name]
-+        else:
-+            if self.service_name in base_services.wellknownports:
-+                ports = base_services.wellknownports[self.service_name]
-+        if ports:
-+            ipautil.wait_for_open_ports('localhost', ports, api.env.startup_timeout)
-+    def stop(self, instance_name='', capture_output=True):
-+        ipautil.run([paths.SBIN_SERVICE, self.service_name, "stop",
-+                     instance_name], capture_output=capture_output)
-+        if 'context' in api.env and api.env.context in ['ipactl', 'installer']:
-+            update_service_list = True
-+        else:
-+            update_service_list = False
-+        super(DebianSysvService, self).stop(instance_name)
-+
-+    def start(self, instance_name='', capture_output=True, wait=True):
-+        ipautil.run([paths.SBIN_SERVICE, self.service_name, "start",
-+                     instance_name], capture_output=capture_output)
-+        if 'context' in api.env and api.env.context in ['ipactl', 'installer']:
-+            update_service_list = True
-+        else:
-+            update_service_list = False
-+        if wait and self.is_running(instance_name):
-+            self.__wait_for_open_ports(instance_name)
-+        super(DebianSysvService, self).start(instance_name)
-+
-+    def restart(self, instance_name='', capture_output=True, wait=True):
-+        ipautil.run([paths.SBIN_SERVICE, self.service_name, "restart",
-+                     instance_name], capture_output=capture_output)
-+        if wait and self.is_running(instance_name):
-+            self.__wait_for_open_ports(instance_name)
-+
-+    def is_running(self, instance_name=""):
-+        ret = True
-+        try:
-+            result = ipautil.run([paths.SBIN_SERVICE,
-+                                  self.service_name, "status",
-+                                  instance_name],
-+                                  capture_output=True)
-+            sout = result.output
-+            if sout.find("NOT running") >= 0:
-+                ret = False
-+            if sout.find("stop") >= 0:
-+                ret = False
-+            if sout.find("inactive") >= 0:
-+                ret = False
-+        except ipautil.CalledProcessError:
-+                ret = False
-+        return ret
-+
-+    def is_installed(self):
-+        installed = True
-+        try:
-+            ipautil.run([paths.SBIN_SERVICE, self.service_name, "status"])
-+        except ipautil.CalledProcessError, e:
-+            if e.returncode == 1:
-+                # service is not installed or there is other serious issue
-+                installed = False
-+        return installed
-+
-+    def is_enabled(self, instance_name=""):
-+        # Services are always assumed to be enabled when installed
-+        return True
-+
-+    def enable(self):
-+        return True
-+
-+    def disable(self):
-+        return True
-+
-+    def install(self):
-+        return True
-+
-+    def remove(self):
-+        return True
-+
-+    def tune_nofile_platform(self):
-+        return True
-+
-+# For services which have no Debian counterpart
-+class DebianNoService(base_services.PlatformService):
-+    def start(self):
-+        return True
-+
-+    def stop(self):
-+        return True
-+
-+    def restart(self):
-+        return True
-+
-+    def disable(self):
-+        return True
-+
-+class DebianSSHService(DebianSysvService):
-+    def get_config_dir(self, instance_name=""):
-+        return '/etc/ssh'
-+
-+# Function that constructs proper Debian-specific server classes for services
-+# of specified name
-+
-+def debian_service_class_factory(name):
-+    if name == 'dirsrv':
-+        return redhat_services.RedHatDirectoryService(name)
-+    if name == 'domainname':
-+        return DebianNoService(name)
-+    if name == 'ipa':
-+        return redhat_services.RedHatIPAService(name)
-+    if name == 'messagebus':
-+        return DebianNoService(name)
-+    if name == 'ntpd':
-+        return DebianSysvService("ntp")
-+    if name == 'sshd':
-+        return DebianSSHService(name)
-+    return DebianService(name)
-+
-+
-+# Magicdict containing DebianService instances.
-+
-+class DebianServices(base_services.KnownServices):
-+    def __init__(self):
-+        services = dict()
-+        for s in base_services.wellknownservices:
-+            services[s] = debian_service_class_factory(s)
-+        # Call base class constructor. This will lock services to read-only
-+        super(DebianServices, self).__init__(services)
-+
-+
-+# Objects below are expected to be exported by platform module
-+
-+from ipaplatform.base.services import timedate_services
-+service = debian_service_class_factory
-+knownservices = DebianServices()
--- /dev/null
-+++ b/ipaplatform/debian/tasks.py
-@@ -0,0 +1,61 @@
-+# Authors:
-+#   Timo Aaltonen <tjaalton@ubuntu.com>
-+#
-+# Copyright (C) 2014 Timo Aaltonen
-+# see file 'COPYING' for use and warranty information
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation, either version 3 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+
-+"""
-+This module contains default Debian-specific implementations of system tasks.
-+"""
-+
-+from ipaplatform.paths import paths
-+from ipaplatform.base.tasks import *
-+from ipaplatform.redhat.tasks import RedHatTaskNamespace
-+
-+BaseTask = BaseTaskNamespace()
-+
-+class DebianTaskNamespace(RedHatTaskNamespace):
-+
-+    def restore_pre_ipa_client_configuration(self, fstore, statestore,
-+                                             was_sssd_installed,
-+                                             was_sssd_configured):
-+        # Debian doesn't use authconfig, nothing to restore
-+        return True
-+
-+    def set_nisdomain(self, nisdomain):
-+        # Debian doesn't use authconfig, nothing to set
-+        return True
-+
-+    def modify_nsswitch_pam_stack(self, sssd, mkhomedir, statestore):
-+        # Debian doesn't use authconfig, this is handled by pam-auth-update
-+        return True
-+
-+    def modify_pam_to_use_krb5(self, statestore):
-+        # Debian doesn't use authconfig, this is handled by pam-auth-update
-+        return True
-+
-+    def backup_auth_configuration(self, path):
-+        # Debian doesn't use authconfig, nothing to backup
-+        return True
-+
-+    def restore_auth_configuration(self, path):
-+        # Debian doesn't use authconfig, nothing to restore
-+        return True
-+
-+    def parse_ipa_version(self, version):
-+        return BaseTask.parse_ipa_version(version)
-+
-+tasks = DebianTaskNamespace()
--- a/ipaplatform/setup.py.in
-+++ b/ipaplatform/setup.py.in
-@@ -66,6 +66,7 @@ def setup_package():
-             package_dir = {'ipaplatform': ''},
-             packages = ["ipaplatform",
-                         "ipaplatform.base",
-+                        "ipaplatform.debian",
-                         "ipaplatform.fedora",
-                         "ipaplatform.redhat",
-                         "ipaplatform.rhel"],
--- a/ipaserver/install/ntpinstance.py
-+++ b/ipaserver/install/ntpinstance.py
-@@ -70,6 +70,8 @@ class NTPInstance(service.Service):
-             os = "fedora"
-         elif ipautil.file_exists(paths.ETC_REDHAT_RELEASE):
-             os = "rhel"
-+        elif ipautil.file_exists(paths.ETC_DEBIAN_VERSION):
-+            os = "debian"
- 
-         srv_vals = []
-         srv_vals.append("0.%s.pool.ntp.org" % os)
--- /dev/null
-+++ b/ipaplatform/debian/constants.py
-@@ -0,0 +1,25 @@
-+#
-+# Copyright (C) 2015  FreeIPA Contributors see COPYING for license
-+#
-+
-+'''
-+This Debian family platform module exports platform dependant constants.
-+'''
-+
-+# Fallback to default path definitions
-+from ipaplatform.base.constants import BaseConstantsNamespace
-+
-+
-+class DebianConstantsNamespace(BaseConstantsNamespace):
-+    HTTPD_USER = "www-data"
-+    NAMED_USER = "bind"
-+    NAMED_GROUP = "bind"
-+    # ntpd init variable used for daemon options
-+    NTPD_OPTS_VAR = "NTPD_OPTS"
-+    # quote used for daemon options
-+    NTPD_OPTS_QUOTE = "\'"
-+    ODS_USER = "opendnssec"
-+    ODS_GROUP = "opendnssec"
-+    SECURE_NFS_VAR = "NEED_GSSD"
-+
-+constants = DebianConstantsNamespace()
@@ -1,33 +1,25 @@
--- a/daemons/dnssec/ipa-dnskeysyncd.service
-+++ b/daemons/dnssec/ipa-dnskeysyncd.service
-@@ -2,11 +2,11 @@
- Description=IPA key daemon
- 
+--- a/daemons/dnssec/ipa-dnskeysyncd.service.in
+++ b/daemons/dnssec/ipa-dnskeysyncd.service.in
+@@ -4,9 +4,9 @@ Description=IPA key daemon
 [Service]
-EnvironmentFile=/etc/sysconfig/ipa-dnskeysyncd
-ExecStart=/usr/libexec/ipa/ipa-dnskeysyncd
+ EnvironmentFile=@sysconfenvdir@/ipa-dnskeysyncd
+ ExecStart=@libexecdir@/ipa/ipa-dnskeysyncd
 -User=ods
 -Group=named
 -SupplementaryGroups=ods
-+EnvironmentFile=/etc/default/ipa-dnskeysyncd
-+ExecStart=/usr/lib/ipa/ipa-dnskeysyncd
 +User=opendnssec
 +Group=bind
 +SupplementaryGroups=opendnssec
 PrivateTmp=yes
 Restart=on-failure
 RestartSec=60s
--- a/daemons/dnssec/ipa-ods-exporter.service
-+++ b/daemons/dnssec/ipa-ods-exporter.service
-@@ -4,9 +4,9 @@ Wants=ipa-ods-exporter.socket
- After=ipa-ods-exporter.socket
- 
+--- a/daemons/dnssec/ipa-ods-exporter.service.in
+++ b/daemons/dnssec/ipa-ods-exporter.service.in
+@@ -6,7 +6,7 @@ After=ipa-ods-exporter.socket
 [Service]
-EnvironmentFile=/etc/sysconfig/ipa-ods-exporter
-ExecStart=/usr/libexec/ipa/ipa-ods-exporter
+ EnvironmentFile=@sysconfenvdir@/ipa-ods-exporter
+ ExecStart=@libexecdir@/ipa/ipa-ods-exporter
 -User=ods
-+EnvironmentFile=/etc/default/ipa-ods-exporter
-+ExecStart=/usr/lib/ipa/ipa-ods-exporter
 +User=opendnssec
 PrivateTmp=yes
 Restart=on-failure
@@ -10,20 +10,16 @@ Description: Fix paths
 
 
 # Configure mod_wsgi handler for /ipa
-@@ -63,9 +63,9 @@ WSGIScriptReloading Off
- <Location "/ipa">
-   AuthType GSSAPI
-   AuthName "Kerberos Login"
-  GssapiCredStore keytab:/etc/httpd/conf/ipa.keytab
-  GssapiCredStore client_keytab:/etc/httpd/conf/ipa.keytab
-  GssapiDelegCcacheDir /var/run/httpd/ipa/clientcaches
-+  GssapiCredStore keytab:/etc/apache2/ipa.keytab
-+  GssapiCredStore client_keytab:/etc/apache2/ipa.keytab
-+  GssapiDelegCcacheDir /var/run/apache2/ipa/clientcaches
-   GssapiDelegCcacheUnique On
-   GssapiUseS4U2Proxy on
-   GssapiAllowedMech krb5
-@@ -111,7 +111,7 @@ WSGIScriptReloading Off
+@@ -68,7 +68,7 @@ WSGIScriptReloading Off
+   SessionCookieName ipa_session path=/ipa;httponly;secure;
+   SessionHeader IPASESSION
+   SessionMaxAge 1800
+-  GssapiSessionKey file:/etc/httpd/alias/ipasession.key
+  GssapiSessionKey file:/etc/apache2/ipasession.key
+ 
+   GssapiDelegCcacheDir /var/run/ipa/ccaches
+   GssapiDelegCcachePerms mode:0660 gid:ipaapi
+@@ -112,7 +112,7 @@ Alias /ipa/session/cookie "/usr/share/ip
 # Custodia stuff is redirected to the custodia daemon
 # after authentication
 <Location "/ipa/keys/">
@@ -32,7 +28,7 @@ Description: Fix paths
     RequestHeader set GSS_NAME %{GSS_NAME}s
     RequestHeader set REMOTE_USER %{REMOTE_USER}s
 </Location>
-@@ -145,8 +145,8 @@ Alias /ipa/crl "$CRL_PUBLISH_PATH"
+@@ -146,8 +146,8 @@ Alias /ipa/crl "$CRL_PUBLISH_PATH"
 
 
 #  List explicitly only the fonts we want to serve
@@ -1,12 +0,0 @@
--- a/daemons/ipa-otpd/Makefile.am
-+++ b/daemons/ipa-otpd/Makefile.am
-@@ -2,7 +2,8 @@ AM_CFLAGS := @LDAP_CFLAGS@ @LIBVERTO_CFL
- AM_LDFLAGS := @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@
- 
- noinst_HEADERS = internal.h
-libexec_PROGRAMS = ipa-otpd
-+appdir = $(libexecdir)/ipa/
-+app_PROGRAMS = ipa-otpd
- dist_noinst_DATA = ipa-otpd.socket.in ipa-otpd@.service.in test.py
- systemdsystemunit_DATA = ipa-otpd.socket ipa-otpd@.service
- 
@@ -1,11 +0,0 @@
--- a/daemons/ipa-otpd/ipa-otpd@.service.in
-+++ b/daemons/ipa-otpd/ipa-otpd@.service.in
-@@ -3,7 +3,7 @@ Description=ipa-otpd service
- 
- [Service]
- EnvironmentFile=@sysconfdir@/ipa/default.conf
-ExecStart=@libexecdir@/ipa-otpd $ldap_uri
-+ExecStart=@libexecdir@/ipa/ipa-otpd $ldap_uri
- StandardInput=socket
- StandardOutput=socket
- StandardError=syslog
@@ -1,20 +0,0 @@
--- a/init/ipa_memcached.conf
-+++ b/init/ipa_memcached.conf
-@@ -1,5 +1,5 @@
- SOCKET_PATH=/var/run/ipa_memcached/ipa_memcached
-USER=apache
-+USER=www-data
- MAXCONN=1024
- CACHESIZE=64
- OPTIONS=
--- a/init/systemd/ipa_memcached.service
-+++ b/init/systemd/ipa_memcached.service
-@@ -4,7 +4,7 @@ After=network.target
- 
- [Service]
- Type=forking
-EnvironmentFile=/etc/sysconfig/ipa_memcached
-+EnvironmentFile=/etc/default/ipa_memcached
- PIDFile=/var/run/ipa_memcached/ipa_memcached.pid
- ExecStart=/usr/bin/memcached -d -s $SOCKET_PATH -u $USER -m $CACHESIZE -c $MAXCONN -P /var/run/ipa_memcached/ipa_memcached.pid $OPTIONS
- 
@@ -1,58 +0,0 @@
--- a/install/oddjob/etc/dbus-1/system.d/oddjob-ipa-trust.conf
-+++ b/install/oddjob/etc/dbus-1/system.d/oddjob-ipa-trust.conf
-@@ -30,7 +30,7 @@
-            send_member="Get"/>
-   </policy>
- 
-  <policy user="apache">
-+  <policy user="www-data">
-     <allow send_destination="com.redhat.idm.trust"
-            send_path="/"
-            send_interface="com.redhat.idm.trust"
--- a/install/oddjob/etc/dbus-1/system.d/org.freeipa.server.conf
-+++ b/install/oddjob/etc/dbus-1/system.d/org.freeipa.server.conf
-@@ -10,7 +10,7 @@
-     <allow send_destination="org.freeipa.server" send_interface="org.freeipa.server"/>
-   </policy>
- 
-  <policy user="apache">
-+  <policy user="www-data">
-     <allow send_destination="org.freeipa.server" send_interface="org.freeipa.server"/>
-   </policy>
- 
--- a/install/oddjob/etc/oddjobd.conf.d/ipa-server.conf
-+++ b/install/oddjob/etc/oddjobd.conf.d/ipa-server.conf
-@@ -2,11 +2,11 @@
- <oddjobconfig>
-   <service name="org.freeipa.server">
-     <allow user="root"/>
-    <allow user="apache"/>
-+    <allow user="www-data"/>
-     <object name="/">
-       <interface name="org.freeipa.server">
-         <method name="conncheck">
-          <helper exec="/usr/libexec/ipa/oddjob/org.freeipa.server.conncheck"
-+          <helper exec="/usr/lib/ipa/oddjob/org.freeipa.server.conncheck"
-                   arguments="1"
-                   prepend_user_name="no"
-                   argument_passing_method="cmdline"/>
--- a/install/oddjob/etc/oddjobd.conf.d/oddjobd-ipa-trust.conf
-+++ b/install/oddjob/etc/oddjobd.conf.d/oddjobd-ipa-trust.conf
-@@ -2,7 +2,7 @@
- <oddjobconfig>
-   <service name="com.redhat.idm.trust">
-     <allow user="root"/>
-    <allow user="apache"/>
-+    <allow user="www-data"/>
-     <object name="/">
-       <interface name="org.freedesktop.DBus.Introspectable">
-         <allow min_uid="0" max_uid="0"/>
-@@ -10,7 +10,7 @@
-       </interface>
-       <interface name="com.redhat.idm.trust">
-         <method name="fetch_domains">
-          <helper exec="/usr/libexec/ipa/oddjob/com.redhat.idm.trust-fetch-domains"
-+          <helper exec="/usr/lib/ipa/oddjob/com.redhat.idm.trust-fetch-domains"
- 		  arguments="1"
-                   argument_passing_method="cmdline"
- 		  prepend_user_name="no"/>
@@ -1,11 +1,11 @@
 --- a/ipaserver/install/server/replicainstall.py
 +++ b/ipaserver/install/server/replicainstall.py
-@@ -630,7 +630,7 @@ def install_check(installer):
+@@ -768,7 +768,7 @@ def install_check(installer):
         finally:
             shutil.rmtree(tmp_db_dir)
 
 -    ldapuri = 'ldaps://%s' % ipautil.format_netloc(config.master_host_name)
 +    ldapuri = 'ldap://%s' % ipautil.format_netloc(config.master_host_name)
     remote_api = create_api(mode=None)
-     remote_api.bootstrap(in_server=True, context='installer',
-                          ldap_uri=ldapuri)
+     remote_api.bootstrap(in_server=True,
+                          context='installer',
@@ -1,125 +0,0 @@
-commit 2775042787be4ea236c0b99dd75337414e24b89d
-Author: Simo Sorce <simo@redhat.com>
-Date:   Tue Nov 1 15:13:14 2016 -0400
-
-    Support DAL version 5 and version 6
-    
-    https://fedorahosted.org/freeipa/ticket/6466
-    
-    Signed-off-by: Simo Sorce <simo@redhat.com>
-    Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
-    Reviewed-By: Robbie Harwood <rharwood@redhat.com>
-
-diff --git a/daemons/ipa-kdb/ipa_kdb.c b/daemons/ipa-kdb/ipa_kdb.c
-index fbcb03b..e96353f 100644
--- a/daemons/ipa-kdb/ipa_kdb.c
-+++ b/daemons/ipa-kdb/ipa_kdb.c
-@@ -625,45 +625,69 @@ static void ipadb_free(krb5_context context, void *ptr)
- 
- /* KDB Virtual Table */
- 
-+#if KRB5_KDB_DAL_MAJOR_VERSION == 5
- kdb_vftabl kdb_function_table = {
-    KRB5_KDB_DAL_MAJOR_VERSION,         /* major version number */
-    0,                                  /* minor version number */
-    ipadb_init_library,                 /* init_library */
-    ipadb_fini_library,                 /* fini_library */
-    ipadb_init_module,                  /* init_module */
-    ipadb_fini_module,                  /* fini_module */
-    ipadb_create,                       /* create */
-    NULL,                               /* destroy */
-    ipadb_get_age,                      /* get_age */
-    NULL,                               /* lock */
-    NULL,                               /* unlock */
-    ipadb_get_principal,                /* get_principal */
-    ipadb_free_principal,               /* free_principal */
-    ipadb_put_principal,                /* put_principal */
-    ipadb_delete_principal,             /* delete_principal */
-    ipadb_iterate,                      /* iterate */
-    ipadb_create_pwd_policy,            /* create_policy */
-    ipadb_get_pwd_policy,               /* get_policy */
-    ipadb_put_pwd_policy,               /* put_policy */
-    ipadb_iterate_pwd_policy,           /* iter_policy */
-    ipadb_delete_pwd_policy,            /* delete_policy */
-    ipadb_free_pwd_policy,              /* free_policy */
-    ipadb_alloc,                        /* alloc */
-    ipadb_free,                         /* free */
-    ipadb_fetch_master_key,             /* fetch_master_key */
-    NULL,                               /* fetch_master_key_list */
-    ipadb_store_master_key_list,        /* store_master_key_list */
-    NULL,                               /* dbe_search_enctype */
-    ipadb_change_pwd,                   /* change_pwd */
-    NULL,                               /* promote_db */
-    NULL,                               /* decrypt_key_data */
-    NULL,                               /* encrypt_key_data */
-    ipadb_sign_authdata,                /* sign_authdata */
-    ipadb_check_transited_realms,       /* check_transited_realms */
-    ipadb_check_policy_as,              /* check_policy_as */
-    NULL,                               /* check_policy_tgs */
-    ipadb_audit_as_req,                 /* audit_as_req */
-    NULL,                               /* refresh_config */
-    ipadb_check_allowed_to_delegate     /* check_allowed_to_delegate */
-+    .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION,
-+    .min_ver = 0,
-+    .init_library = ipadb_init_library,
-+    .fini_library = ipadb_fini_library,
-+    .init_module = ipadb_init_module,
-+    .fini_module = ipadb_fini_module,
-+    .create = ipadb_create,
-+    .get_age = ipadb_get_age,
-+    .get_principal = ipadb_get_principal,
-+    .free_principal = ipadb_free_principal,
-+    .put_principal = ipadb_put_principal,
-+    .delete_principal = ipadb_delete_principal,
-+    .iterate = ipadb_iterate,
-+    .create_policy = ipadb_create_pwd_policy,
-+    .get_policy = ipadb_get_pwd_policy,
-+    .put_policy = ipadb_put_pwd_policy,
-+    .iter_policy = ipadb_iterate_pwd_policy,
-+    .delete_policy = ipadb_delete_pwd_policy,
-+    .free_policy = ipadb_free_pwd_policy,
-+    .alloc = ipadb_alloc,
-+    .free = ipadb_free,
-+    .fetch_master_key = ipadb_fetch_master_key,
-+    .store_master_key_list = ipadb_store_master_key_list,
-+    .change_pwd = ipadb_change_pwd,
-+    .sign_authdata = ipadb_sign_authdata,
-+    .check_transited_realms = ipadb_check_transited_realms,
-+    .check_policy_as = ipadb_check_policy_as,
-+    .audit_as_req = ipadb_audit_as_req,
-+    .check_allowed_to_delegate = ipadb_check_allowed_to_delegate
- };
- 
-+#elif KRB5_KDB_DAL_MAJOR_VERSION == 6
-+kdb_vftabl kdb_function_table = {
-+    .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION,
-+    .min_ver = 0,
-+    .init_library = ipadb_init_library,
-+    .fini_library = ipadb_fini_library,
-+    .init_module = ipadb_init_module,
-+    .fini_module = ipadb_fini_module,
-+    .create = ipadb_create,
-+    .get_age = ipadb_get_age,
-+    .get_principal = ipadb_get_principal,
-+    .put_principal = ipadb_put_principal,
-+    .delete_principal = ipadb_delete_principal,
-+    .iterate = ipadb_iterate,
-+    .create_policy = ipadb_create_pwd_policy,
-+    .get_policy = ipadb_get_pwd_policy,
-+    .put_policy = ipadb_put_pwd_policy,
-+    .iter_policy = ipadb_iterate_pwd_policy,
-+    .delete_policy = ipadb_delete_pwd_policy,
-+    .fetch_master_key = ipadb_fetch_master_key,
-+    .store_master_key_list = ipadb_store_master_key_list,
-+    .change_pwd = ipadb_change_pwd,
-+    .sign_authdata = ipadb_sign_authdata,
-+    .check_transited_realms = ipadb_check_transited_realms,
-+    .check_policy_as = ipadb_check_policy_as,
-+    .audit_as_req = ipadb_audit_as_req,
-+    .check_allowed_to_delegate = ipadb_check_allowed_to_delegate
-+};
-+
-+#else
-+#error unsupported DAL major version
-+#endif
-+
@@ -1,632 +0,0 @@
-commit 5d6e79b8f03198056103a31acc20536f8323756d
-Author: Timo Aaltonen <tjaalton@debian.org>
-Date:   Tue Mar 29 21:33:15 2016 +0300
-
-    Purge firefox extension
-
--- a/freeipa.spec.in
-+++ b/freeipa.spec.in
-@@ -165,7 +165,6 @@ Requires: pki-ca >= 10.3.5-6
- Requires: pki-kra >= 10.3.5-6
- Requires(preun): python systemd-units
- Requires(postun): python systemd-units
-Requires: zip
- Requires: policycoreutils >= 2.1.12-5
- Requires: tar
- Requires(pre): certmonger >= 0.78
--- a/install/Makefile.am
-+++ b/install/Makefile.am
-@@ -7,7 +7,6 @@ NULL =
- SUBDIRS =			\
-         certmonger		\
-         conf			\
-        ffextension		\
-         html			\
-         migration		\
-         share			\
--- a/install/ffextension/Makefile.am
-+++ /dev/null
-@@ -1,23 +0,0 @@
-AUTOMAKE_OPTIONS = 1.7
-
-NULL =
-
-SUBDIRS =  				\
-	chrome				\
-	locale				\
-	$(NULL)
-
-appdir = $(IPA_DATA_DIR)/ffextension
-app_DATA =				\
-	bootstrap.js			\
-	chrome.manifest			\
-	install.rdf			\
-	$(NULL)
-
-EXTRA_DIST =                            \
-        $(app_DATA)                     \
-        $(NULL)
-
-MAINTAINERCLEANFILES =                  \
-        *~                              \
-        Makefile.in
--- a/install/ffextension/bootstrap.js
-+++ /dev/null
-@@ -1,88 +0,0 @@
-// Heavily inspired by Dave Townsend's post:
-// Playing with windows in restartless (bootstrapped) extensions
-// http://www.oxymoronical.com/blog/2011/01/Playing-with-windows-in-restartless-bootstrapped-extensions
-
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
-
-var WindowListener = {
-
-    setupBrowserUI: function(domWindow) {
-        var doc = domWindow.document;
-        domWindow.kerberosauth_listener = kerberosauth_listener(domWindow);
-        doc.addEventListener('kerberos-auth-config', domWindow.kerberosauth_listener, false, true);
-    },
-
-    tearDownBrowserUI: function(domWindow) {
-
-        var doc = domWindow.document;
-        doc.removeEventListener('kerberos-auth-config', domWindow.kerberosauth_listener);
-        delete domWindow.kerberosauth_listener;
-    },
-
-    // nsIWindowMediatorListener functions
-    onOpenWindow: function(xulWindow) {
-        // A new window has opened
-        var domWindow = xulWindow.QueryInterface(Ci.nsIInterfaceRequestor).
-                                  getInterface(Ci.nsIDOMWindowInternal);
-
-        // Wait for it to finish loading
-        domWindow.addEventListener("load", function listener() {
-            domWindow.removeEventListener("load", listener, false);
-
-            // If this is a browser window then setup its UI
-            if (domWindow.document.documentElement.getAttribute("windowtype") === "navigator:browser") {
-                WindowListener.setupBrowserUI(domWindow);
-            }
-        }, false);
-    },
-
-    onCloseWindow: function(xulWindow) {
-    },
-
-    onWindowTitleChange: function(xulWindow, newTitle) {
-    }
-};
-
-function startup(data, reason) {
-    var wm = Cc["@mozilla.org/appshell/window-mediator;1"].getService(Ci.nsIWindowMediator);
-
-    Cu['import']("chrome://kerberosauth/content/kerberosauth.js");
-
-    // Get the list of browser windows already open
-    var windows = wm.getEnumerator("navigator:browser");
-    while (windows.hasMoreElements()) {
-        var domWindow = windows.getNext().QueryInterface(Ci.nsIDOMWindow);
-
-        WindowListener.setupBrowserUI(domWindow);
-    }
-
-    // Wait for any new browser windows to open
-    wm.addListener(WindowListener);
-}
-
-function shutdown(data, reason) {
-    // When the application is shutting down we normally don't have to clean
-    // up any UI changes made
-    if (reason == APP_SHUTDOWN)
-        return;
-
-    var wm = Cc["@mozilla.org/appshell/window-mediator;1"].
-        getService(Ci.nsIWindowMediator);
-
-    // Get the list of browser windows already open
-    var windows = wm.getEnumerator("navigator:browser");
-    while (windows.hasMoreElements()) {
-        var domWindow = windows.getNext().QueryInterface(Ci.nsIDOMWindow);
-        WindowListener.tearDownBrowserUI(domWindow);
-    }
-
-    // Stop listening for any new browser windows to open
-    wm.removeListener(WindowListener);
-
-    Cu.unload("chrome://kerberosauth/content/kerberosauth.js");
-}
-
-function install() {}
-function uninstall() {}
-\ No newline at end of file
--- a/install/ffextension/chrome.manifest
-+++ /dev/null
-@@ -1,4 +0,0 @@
-content    kerberosauth     chrome/content/
-resource   kerberosauth     chrome/content/
-overlay chrome://browser/content/browser.xul    resource://kerberosauth/kerberosauth_overlay.xul
-locale     kerberosauth    en-US   locale/en-US/
-\ No newline at end of file
--- a/install/ffextension/chrome/Makefile.am
-+++ /dev/null
-@@ -1,19 +0,0 @@
-AUTOMAKE_OPTIONS = 1.7
-
-NULL =
-
-SUBDIRS =  				\
-	content				\
-	$(NULL)
-
-appdir = $(IPA_DATA_DIR)/ffextension/chrome
-app_DATA =				\
-	$(NULL)
-
-EXTRA_DIST =                            \
-        $(app_DATA)                     \
-        $(NULL)
-
-MAINTAINERCLEANFILES =                  \
-        *~                              \
-        Makefile.in
--- a/install/ffextension/chrome/content/Makefile.am
-+++ /dev/null
-@@ -1,17 +0,0 @@
-AUTOMAKE_OPTIONS = 1.7
-
-NULL =
-
-appdir = $(IPA_DATA_DIR)/ffextension/chrome/content
-app_DATA =				\
-	kerberosauth_overlay.xul	\
-	kerberosauth.js			\
-	$(NULL)
-
-EXTRA_DIST =                            \
-        $(app_DATA)                     \
-        $(NULL)
-
-MAINTAINERCLEANFILES =                  \
-        *~                              \
-        Makefile.in
--- a/install/ffextension/chrome/content/kerberosauth.js
-+++ /dev/null
-@@ -1,197 +0,0 @@
-/*  Authors:
- *    Petr Vobornik <pvoborni@redhat.com>
- *
- * Copyright (C) 2012 Red Hat
- * see file 'COPYING' for use and warranty information
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-var EXPORTED_SYMBOLS = ["kerberosauth", "kerberosauth_listener"];
-
-var Cc = Components.classes;
-var Ci = Components.interfaces;
-
-var kerberosauth = {
-
-    // Dictionary of configuration options this extension can configure.
-    // An alias (key) is set for each options. Using a set of aliases limits
-    // configuration pages from supplying potential malicious options.
-    config_options: {
-        referer: ['network.http.sendRefererHeader', 'int'],
-        native_gss_lib: ['network.negotiate-auth.using-native-gsslib', 'bool'],
-        trusted_uris: ['network.negotiate-auth.trusted-uris', 'str'],
-        allow_proxies: ['network.negotiate-auth.allow-proxies', 'bool']
-    },
-
-    // Some preconfigurations to make things easier. Can be good if UI is added
-    // (mostly for future usage).
-    predefined_configurations: {
-        ipa: {
-            referer: '2',
-            native_gss_lib: 'true',
-            trusted_uris: '',
-            allow_proxies: 'true',
-            append: ['trusted_uris']
-        }
-    },
-
-    page_listener: function(event, dom_window) {
-
-        var self = this;
-
-        var conf = {
-            event: event,
-            window: dom_window || window,
-            element: event.target
-        };
-
-        if (!conf.element.hasAttribute('method')) return;
-
-        var method = conf.element.getAttribute('method');
-
-        if (method === 'configure') self.configure(conf);
-        if (method === 'can_configure') self.send_response(conf.element, { answer: 'true' });
-    },
-
-    send_response: function(element, options) {
-
-        options = options || {};
-
-        var doc = element.ownerDocument;
-
-        for (var opt in options) {
-            element.setAttribute(opt, options[opt]);
-        }
-
-        var answer_event = doc.createEvent("HTMLEvents");
-        answer_event.initEvent("kerberos-auth-answer", true, false);
-        element.dispatchEvent(answer_event);
-    },
-
-    notify_installed: function(window) {
-        var doc = window.document;
-        var event = doc.createEvent("HTMLEvents");
-        event.initEvent("kerberos-auth-installed", true, false);
-        doc.dispatchEvent(event);
-    },
-
-    configure: function(conf) {
-        var self = this;
-
-        var options = {}; // options to be configured
-        var opt;
-
-        // use predefined configuration if supplied
-        if (conf.element.hasAttribute('predefined')) {
-            var predefined = conf.element.getAttribute('predefined');
-
-            var pconfig = self.predefined_configurations[predefined];
-            if (pconfig) {
-                for (opt in pconfig) {
-                    options[opt] = pconfig[opt];
-                }
-            }
-        }
-
-        // overwrite predefined with supplied and only supported options
-        for (var i=0; i < conf.element.attributes.length; i++) {
-            var attr = conf.element.attributes[i].name;
-            if (attr in self.config_options) {
-                options[attr] =  conf.element.getAttribute(attr);
-            }
-        }
-
-        if (self.prompt(conf, options)) {
-            self.configure_core(conf, options);
-            self.send_response(conf.element, { answer: 'configured' });
-        } else {
-            self.send_response(conf.element, { answer: 'aborted' });
-        }
-    },
-
-    configure_core: function(conf, options) {
-
-        var self = this;
-
-        var prefs = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);
-        var append_opts = options.append || [];
-
-        for (var opt in options) {
-
-            if (!self.config_options[opt]) continue;
-
-            var name = self.config_options[opt][0];
-            var type = self.config_options[opt][1];
-            var value = options[opt];
-
-            if (type === 'str') {
-                if (value && append_opts.indexOf(opt) > -1) {
-                    var current = prefs.getCharPref(name) || '';
-                    if (this.str_contains(current, value)) {
-                        continue;
-                    } else if (current) {
-                        value = current + ', ' + value;
-                    }
-                }
-                prefs.setCharPref(name, value);
-            } else if (type ==='int') {
-                prefs.setIntPref(name, Number(value));
-            } else if (type === 'bool') {
-                prefs.setBoolPref(name, value === 'true');
-            }
-        }
-    },
-
-    str_contains: function(str, value) {
-
-        if (!str) return false;
-        var vals = str.split(',');
-        for (var i=0, l=vals.length; i<l; i++) {
-            if (vals[i].trim() === value) return true;
-        }
-        return false;
-    },
-
-    prompt: function(conf, options) {
-        var strs = Cc["@mozilla.org/intl/stringbundle;1"].
-                        getService(Ci.nsIStringBundleService).
-                        createBundle("chrome://kerberosauth/locale/kerberosauth.properties");
-
-        var prompts = Cc["@mozilla.org/embedcomp/prompt-service;1"].
-                        getService(Ci.nsIPromptService);
-
-        var title = strs.GetStringFromName('prompt_title');
-        var text = strs.GetStringFromName('prompt_topic');
-
-        if (options.trusted_uris) {
-            text += strs.GetStringFromName('prompt_domain').replace('${domain}', options.trusted_uris);
-        }
-        text +=  strs.GetStringFromName('prompt_question');
-
-        var flags = prompts.STD_YES_NO_BUTTONS;
-
-        var confirmed = prompts.confirmEx(conf.window, title, text, flags, "","","",
-                                        null,{value: false}) === 0;
-        return confirmed;
-    }
-};
-
-var kerberosauth_listener = function(window) {
-
-    return function(event) {
-
-        kerberosauth.page_listener(event, window);
-    };
-};
-\ No newline at end of file
--- a/install/ffextension/chrome/content/kerberosauth_overlay.xul
-+++ /dev/null
-@@ -1,9 +0,0 @@
-<?xml version="1.0"?>
-
-<overlay id="kerberosauthOverlay" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-    <script type="application/x-javascript">
-        Components.utils['import']("resource://kerberosauth/kerberosauth.js");
-        window.addEventListener('kerberos-auth-config', kerberosauth_listener(window), false, true);
-    </script>
-</overlay>
-\ No newline at end of file
--- a/install/ffextension/install.rdf
-+++ /dev/null
-@@ -1,26 +0,0 @@
-<?xml version="1.0"?>
-<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-     xmlns:em="http://www.mozilla.org/2004/em-rdf#">
-
-    <Description about="urn:mozilla:install-manifest">
-
-        <em:id>kerberosauth@redhat.com</em:id>
-        <em:name>Kerberos Configuration</em:name>
-        <em:version>0.1</em:version>
-        <em:description>Configures browser to use negotiate authentication</em:description>
-        <em:type>2</em:type>
-        <em:creator>Red Hat, Inc.</em:creator>
-        <em:developer>Petr Vobornik</em:developer>
-        <em:homepageURL>http://www.redhat.com/</em:homepageURL>
-        <em:bootstrap>true</em:bootstrap>
-
-         <!-- Firefox -->
-        <em:targetApplication>
-            <Description>
-                <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
-                <em:minVersion>10.0</em:minVersion>
-                <em:maxVersion>15.0.*</em:maxVersion>
-            </Description>
-        </em:targetApplication>
-    </Description>
-</RDF>
-\ No newline at end of file
--- a/install/ffextension/locale/Makefile.am
-+++ /dev/null
-@@ -1,19 +0,0 @@
-AUTOMAKE_OPTIONS = 1.7
-
-NULL =
-
-SUBDIRS =  				\
-	en-US				\
-	$(NULL)
-
-appdir = $(IPA_DATA_DIR)/ffextension/locale
-app_DATA =				\
-	$(NULL)
-
-EXTRA_DIST =                            \
-        $(app_DATA)                     \
-        $(NULL)
-
-MAINTAINERCLEANFILES =                  \
-        *~                              \
-        Makefile.in
--- a/install/ffextension/locale/en-US/Makefile.am
-+++ /dev/null
-@@ -1,16 +0,0 @@
-AUTOMAKE_OPTIONS = 1.7
-
-NULL =
-
-appdir = $(IPA_DATA_DIR)/ffextension/locale/en-US
-app_DATA =				\
-	kerberosauth.properties		\
-	$(NULL)
-
-EXTRA_DIST =                            \
-        $(app_DATA)                     \
-        $(NULL)
-
-MAINTAINERCLEANFILES =                  \
-        *~                              \
-        Makefile.in
--- a/install/ffextension/locale/en-US/kerberosauth.properties
-+++ /dev/null
-@@ -1,4 +0,0 @@
-prompt_title=Kerberos configuration confirmation
-prompt_topic=The page you are visiting is trying to configure Firefox for Kerberos authentication.
-prompt_domain=\n\nDomain: ${domain}
-prompt_question=\n\nDo you want to configure the browser?
-\ No newline at end of file
--- a/install/share/Makefile.am
-+++ b/install/share/Makefile.am
-@@ -51,7 +51,6 @@ app_DATA =				\
- 	krb5.conf.template		\
- 	krb5.ini.template		\
- 	krb.con.template		\
-	krb.js.template			\
- 	krbrealm.con.template		\
- 	smb.conf.template		\
- 	smb.conf.empty			\
--- a/install/share/krb.js.template
-+++ /dev/null
-@@ -1,2 +0,0 @@
-var IPA_REALM = "$REALM";
-var IPA_DOMAIN = "$DOMAIN";
-\ No newline at end of file
--- a/ipaplatform/base/paths.py
-+++ b/ipaplatform/base/paths.py
-@@ -184,7 +184,6 @@ class BasePathNamespace(object):
-     BIN_TIMEOUT = "/usr/bin/timeout"
-     UPDATE_CA_TRUST = "/usr/bin/update-ca-trust"
-     BIN_CURL = "/usr/bin/curl"
-    ZIP = "/usr/bin/zip"
-     BIND_LDAP_SO = "/usr/lib/bind/ldap.so"
-     BIND_LDAP_DNS_IPA_WORKDIR = "/var/named/dyndb-ldap/ipa/"
-     BIND_LDAP_DNS_ZONE_WORKDIR = "/var/named/dyndb-ldap/ipa/master/"
-@@ -231,12 +230,9 @@ class BasePathNamespace(object):
-     USERADD = "/usr/sbin/useradd"
-     USR_SHARE_IPA_DIR = "/usr/share/ipa/"
-     CA_TOPOLOGY_ULDIF = "/usr/share/ipa/ca-topology.uldif"
-    FFEXTENSION = "/usr/share/ipa/ffextension"
-     IPA_HTML_DIR = "/usr/share/ipa/html"
-     CA_CRT = "/usr/share/ipa/html/ca.crt"
-    KERBEROSAUTH_XPI = "/usr/share/ipa/html/kerberosauth.xpi"
-     KRB_CON = "/usr/share/ipa/html/krb.con"
-    KRB_JS = "/usr/share/ipa/html/krb.js"
-     HTML_KRB5_INI = "/usr/share/ipa/html/krb5.ini"
-     HTML_KRBREALM_CON = "/usr/share/ipa/html/krbrealm.con"
-     NIS_ULDIF = "/usr/share/ipa/nis.uldif"
--- a/ipaserver/install/httpinstance.py
-+++ b/ipaserver/install/httpinstance.py
-@@ -130,7 +130,7 @@ class HTTPInstance(service.Service):
-     subject_base = ipautil.dn_attribute_property('_subject_base')
- 
-     def create_instance(self, realm, fqdn, domain_name, dm_password=None,
-                        autoconfig=True, pkcs12_info=None,
-+                        pkcs12_info=None,
-                         subject_base=None, auto_redirect=True, ca_file=None,
-                         ca_is_configured=None, promote=False):
-         self.fqdn = fqdn
-@@ -173,8 +173,6 @@ class HTTPInstance(service.Service):
-         self.step("setting up httpd keytab", self.__create_http_keytab)
-         self.step("setting up ssl", self.__setup_ssl)
-         self.step("importing CA certificates from LDAP", self.__import_ca_certs)
-        if autoconfig:
-            self.step("setting up browser autoconfig", self.__setup_autoconfig)
-         self.step("publish CA cert", self.__publish_ca_cert)
-         self.step("clean up any existing httpd ccache", self.remove_httpd_ccache)
-         self.step("configuring SELinux for httpd", self.configure_selinux_for_httpd)
-@@ -383,42 +381,6 @@ class HTTPInstance(service.Service):
-         db = certs.CertDB(self.realm, subject_base=self.subject_base)
-         self.import_ca_certs(db, self.ca_is_configured)
- 
-    def __setup_autoconfig(self):
-        self.setup_firefox_extension(self.realm, self.domain)
-
-    def setup_firefox_extension(self, realm, domain):
-        """Set up the signed browser configuration extension
-        """
-
-        target_fname = paths.KRB_JS
-        sub_dict = dict(REALM=realm, DOMAIN=domain)
-        db = certs.CertDB(realm)
-        with open(db.passwd_fname) as pwdfile:
-            pwd = pwdfile.read()
-
-        ipautil.copy_template_file(ipautil.SHARE_DIR + "krb.js.template",
-            target_fname, sub_dict)
-        os.chmod(target_fname, 0o644)
-
-        # Setup extension
-        tmpdir = tempfile.mkdtemp(prefix="tmp-")
-        extdir = tmpdir + "/ext"
-        target_fname = paths.KERBEROSAUTH_XPI
-        shutil.copytree(paths.FFEXTENSION, extdir)
-        if db.has_nickname('Signing-Cert'):
-            db.run_signtool(["-k", "Signing-Cert",
-                                "-p", pwd,
-                                "-X", "-Z", target_fname,
-                                extdir])
-        else:
-            root_logger.warning('Object-signing certificate was not found. '
-                'Creating unsigned Firefox configuration extension.')
-            filenames = os.listdir(extdir)
-            ipautil.run([paths.ZIP, '-r', target_fname] + filenames,
-                cwd=extdir)
-        shutil.rmtree(tmpdir)
-        os.chmod(target_fname, 0o644)
-
-     def __publish_ca_cert(self):
-         ca_db = certs.CertDB(self.realm)
-         ca_db.publish_ca_cert(paths.CA_CRT)
--- a/ipaserver/install/server/replicainstall.py
-+++ b/ipaserver/install/server/replicainstall.py
-@@ -186,12 +186,10 @@ def install_http(config, auto_redirect,
-     http = httpinstance.HTTPInstance()
-     http.create_instance(
-         config.realm_name, config.host_name, config.domain_name,
-        config.dirman_password, False, pkcs12_info,
-+        config.dirman_password, pkcs12_info,
-         auto_redirect=auto_redirect, ca_file=ca_file,
-         ca_is_configured=ca_is_configured, promote=promote)
- 
-    http.setup_firefox_extension(config.realm_name, config.domain_name)
-
-     return http
- 
- 
--- a/ipaserver/install/server/upgrade.py
-+++ b/ipaserver/install/server/upgrade.py
-@@ -270,16 +270,6 @@ def cleanup_adtrust(fstore):
-             root_logger.debug('Removing %s from backup', backed_up_file)
- 
- 
-def setup_firefox_extension(fstore):
-    """Set up the Firefox configuration extension, if it's not set up yet
-    """
-    root_logger.info('[Setting up Firefox extension]')
-    http = httpinstance.HTTPInstance(fstore)
-    realm = api.env.realm
-    domain = api.env.domain
-    http.setup_firefox_extension(realm, domain)
-
-
- def upgrade_adtrust_config():
-     """
-     Upgrade 'dedicated keytab file' in smb.conf to omit FILE: prefix
-@@ -1737,7 +1727,6 @@ def upgrade_configuration():
- 
-     cleanup_kdc(fstore)
-     cleanup_adtrust(fstore)
-    setup_firefox_extension(fstore)
-     upgrade_adtrust_config()
- 
-     bind = bindinstance.BindInstance(fstore)
@@ -1,5 +1,4 @@
-# upstreamed
-ipa-kdb-support-dal-version-5-and-6.diff
+# from upstream

 # not upstreamable
 prefix.patch
@@ -7,17 +6,11 @@ hack-libarch.diff
 enable-mod-nss-during-setup.diff

 # send upstream
-add-debian-platform.diff
 fix-ipa-conf.diff
 fix-kdcproxy-paths.diff
-fix-ipa-otpd-install.diff
 fix-replicainstall.diff
 fix-dnssec-services.diff
 create-sysconfig-ods.diff
 fix-named-conf-template.diff
-fix-memcached.diff
-fix-oddjobs.diff
-purge-firefox-extension.diff
-fix-ipa-otpd-service.diff
 fix-is-running.diff
 fix-kdcproxy-path.diff